agenttesla

General

Target
ed84d902e29ec45f20a4dc8e5e4fb5f4.bin
Size 512KB
Sample241114-cayc8asgnf
SHA256 80a5d01a9ab9bb6eb01cb4b05c11f4518f0d6dc2c17a8ebfc18fb7cff04251e4
MD5 64cc767072aa938e3a5161cb1a1d4cb1
SHA1 6f311d5906215e0d2f78083c85e9d3584c1f9266
SHA512 8c5c68e16e0618479ab357842148939d5329bb5108f7cc2c83734cf241dff1038c7269a877aa9f80c41f8d249f028074e955ce114863df4b0f566c37d808b3ba
SSDEEP 12288:L9C5OAvj2vEYheqfToB/moVE0FdHhJJYYP63WfPzMfW9RNgyLjZ:LrE+cHHhJJ7y3aFOyh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://backup.smartape.ru
Port
21
Username
user894492
Password
w6NZOdcSkH1a

Targets

- Target
  06a38526a05f76b261070b725ceea6004f07dd934b729b268cf1d01bc07f232e.exe
- Size 815KB
- SHA256 06a38526a05f76b261070b725ceea6004f07dd934b729b268cf1d01bc07f232e
- MD5 ed84d902e29ec45f20a4dc8e5e4fb5f4
- SHA1 44508cd053dae92d6d9e1427a3633cbaade2e74f
- SHA512 3b0d8dfa1b78d28d566cb8cd389b7d5c32858e0a21c70428b156cf6370dccfc1c3ea7faac009f20309588c4ee3f56679245b6735e350daa06253eda40f9d6c1f
- SSDEEP 12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCfCtFsyYb62EtjUDJGf:uRmJkcoQricOIQxiZY1iaCJyYGptwK
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Agenttesla family

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2